The court reiterated the necessity of following constitutional protocols in data-sharing agreements to protect citizens' privacy rights while acknowledging the state's compelling interest during emergencies.

JUDGMENT :

Soumen Sen, C.J.

1. Although the Covid-19 pandemic situation has come to an end, the series of litigations filed during the pandemic situation has been kept alive to ensure that right to privacy of persons whose data was sought to be shared with a third-party entity, namely the Sprinklr Inc., has not been compromised.

2. These matters were heard last substantially on 24 April 2020.

3. Elaborate submissions have been made on behalf of the parties. However, having regard to the exhaustive and elaborate order passed in these writ petitions by the Division Bench presided over by Mr. Justice Devan Ramachandran on 24.04.2020, at a point of time when the issues seems to have been live, our task has been now easier.

4. We are now required to assess the situation that prevailed during the Covid-19 pandemic as on 02.04.2020, when the Principal Secretary to the Electronics and Information Technology Department, Government of Kerala, entered into an agreement with Sprinklr Inc.. The efficacy of such agreement seems to have been diluted by the order passed by the Division Bench presided over by Mr.Justice Devan Ramachandran on 24.04.2020, in which in paragraph No.24, the following directions were passed:

“24. Resultantly:

(a) We hereby direct the Government of Kerala and its concerned Departments to anonymise all the data that have been collected and collated from the citizens of the State with respect to the COVID-19 epidemic, as also with respect to all data to be collected in the future and to allow Sprinklr to have further access to any such data only after the process of anonymisation is completed.

(b) The Government of Kerala is directed to inform every citizen, from whom data is to be taken in future, that such data is likely to be accessed by Sprinklr or other third party service providers and their specific consent to such effect shall be obtained in the necessary forms or formats.

(c) We hereby injunct Sprinklr from committing any act which will be, directly or indirectly, in breach of confidentiality of the data entrusted to them for analysis/processing by the Government of Kerala under the impugned contract/s; and that they shall not disclose or part with any such data to any third party/person/entity – of whatever nature or composition – anywhere in the world.

(d) We further order that Sprinklr shall not, directly or indirectly, deal with the data or any part of it entrusted to them by the Government of Kerala under the impugned contract/s, in conflict with the various confidentiality clauses/caveats therein; and that they will forthwith entrust back all such data to the Government of Kerala as soon as their contractual obligation, as regards its analysis/processing, is completed as per the requirements under the impugned contract/s.

(e) Since the Government of Kerala has taken the position before us that, according to them, no data is available with Sprinklr as of now, any residual or secondary data available with the latter shall be immediately entrusted back by them to the Government and this shall be treated as a peremptory order.

(f) As a necessary corollary to the above directions, we further injunct Sprinklr from advertising or representing or holding over to any third party/person/entity – of whatever nature or composition – that they are in possession or have access to any data regarding COVID-19 patients or persons vulnerable/susceptible to it; and that they shall not use or exploit any such data, or the name and the official logo of the Government of Kerala, directly